Serious PHP Security Flaws Force Websites Offline Worldwide Amid Millions of Hacking Attempts
Governments and major companies around the world have taken emergency action after two serious security flaws were found in PHP, the widely used programming language behind countless websites. From Wednesday night, many government and commercial organisations temporarily shut down their websites.
Like HTML and Python, PHP is a foundational language of the web. Its developers released updated versions on Wednesday to fix the two flaws. The vulnerabilities were identified using artificial intelligence, and users were urged to update quickly.
Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, said details of the flaws became public before the fixed versions arrived. Since then, reports have emerged of attempts to exploit the flaws to seize control of websites, while organisations rushed to update.
Even amid those update efforts, millions of hacking attempts have been recorded, according to cloud provider Cloudflare. Its chief executive Matthew Prince said on Wednesday that within 45 minutes of the flaws becoming public, attack attempts rose into the thousands, reached several hundred thousand within two hours, and have grown further since.
Several Japanese organisations said on Thursday they had temporarily suspended some online services as an emergency security measure. They include financial group Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway.
Japan's finance ministry and weather agency have also limited their online services, showing that the impact has fallen not only on private companies but directly on government services as well.
French telecoms company Orange said it had temporarily blocked access to PHP-based websites and software at several subsidiaries as a precaution. China's major cloud provider Tencent Cloud has also advised customers to use the updated version.
Experts say the incident is a major test for the foundational programming technology that keeps the internet running. Microsoft chief executive Satya Nadella said on Wednesday that he had not seen such an event in a long time, adding that it underscored the importance of building digital systems that can be maintained securely.
Haya Schulmann, scientific director of the innovation platform at Germany's Fraunhofer cybersecurity institute, described it as one of the most serious incidents of the past two years, called the risks real and urged rapid patching.
Because PHP underpins vast numbers of websites worldwide, the risk is relevant to website operators everywhere, including in Bangladesh. Experts warn that sites which are not updated could remain exposed to attack.
Attention will now be on how quickly organisations worldwide complete the updates and when the suspended services return fully to normal.
